As a person who is interested in smart contract auditing but have never done before I have this question in my head. What if an auditor finds a lets say critical vulnerability which will enable him to steal all the funds in a bug bounty but won't announce this to the audited company? This case they'll be able steal all the funds. How the companies are protecting themselves against such vulnerabilities? Thanks in advance!
2 Answers
This is a good question. We shared similar concerns when selecting an audit company for our infrastructure. Addressing the worry of untrustworthiness from an audit company is crucial. Unfortunately, lots of projects falling victim to attacks by audit firms and experiencing significant financial losses have been observed. While specific cases remain sensitive to discuss openly, it's essential to take precautions.
For my perspective, in terms of "Project", they can
Looks for the "Smart Contract" that have been already proven. For example, the dex router from Uniswap, or the MasterChef pool from Pancakeswap. Then, minor modify it for your problem.
Looks for the "Smart Contract" that have been already audited. Normally, popular auditing company always publish the audit data. Therefore, project can go there to look for the SC suitable with their problem. But, make sure to double check the audit data.
If the two approaches above are not relevant, so, it is important to looks for legitimate auditing company. Some good names in the web3 community are PeckShield and Certik.
That is my thought about it. Hope it helps.
Too high of a risk for too low of a reward. If protocol knows the audit is in process and a specific team of developers is inspecting the code it only makes it easier to get caught. If he was to steal something he wouldn't need to work as an auditor.
